Release of uBlock Origin 1.25 with protection against blocking bypass through DNS manipulation

Available New Release of the Content Blocker uBlock Origin 1.25, providing blocking of ads, malicious elements, tracking codes, JavaScript miners, and other disruptive elements. The uBlock Origin extension is distinguished by its high performance and economical memory usage, allowing users not only to get rid of annoying elements but also to reduce resource consumption and speed up page loading.

In the new version, Firefox users benefit from blocking a new tracking technique that substitutes ad blocks, based on the creation of a separate subdomain in the DNS framework of the current site’s domain. The created subdomain points to the ad network server (for example, a CNAME record f7ds.liberation.fr pointing to the tracking server liberation.eulerian.net), so the ad code is formally loaded from the same primary domain as the site. The name for the subdomain is chosen in the form of a random identifier, making it difficult to block by pattern, as the subdomain associated with the ad network is hard to distinguish from subdomains for loading other local page resources.

In the new version of uBlock Origin, the determination of the host associated via CNAME implemented call for resolving the name in DNS, which allows the application of block lists even for names redirected via CNAME.
From a performance standpoint, determining CNAME should not lead to additional overheads, except for the consumption of CPU resources to reapply rules for another name since, when accessing the resource, the browser has already performed the resolving, and the value should be cached. When installing the new version, permissions must be granted to retrieve information from DNS.

The added protection method based on CNAME verification can be bypassed through direct binding of the name to IP without using CNAME, but this approach complicates the maintenance of the infrastructure (if the ad network IP address changes, data needs to be updated on all the publishers' DNS servers) and can be circumvented by creating a blacklist of tracker IP addresses. In the uBlock Origin build for Chrome, CNAME checking does not work, as the API dns.resolve() available only for add-ons in Firefox and not supported in Chrome.

Source: opennet.ru